# How is the Lai-Massey scheme invertible?

The Wikipedia page on the subject and other descriptions that I can find of it are as clear as mud. $L$ and $R$ are combined to make a number that is then added to both. That seems like a loss of information to me.

One Lai-Massey round can be described as \begin{align} L' &= \sigma(L \oplus F_k(L \oplus R)) \\ R' &= R \oplus F_k(L \oplus R)\,, \end{align} where $F_k$ is some round function—not necessarily invertible—and $\sigma(\cdot)$ is an orthomorphism, an arbitrary function such that both $\sigma(x)$ and $\sigma'(x) = \sigma(x) \oplus x$ are invertible.
To invert this, \begin{align} L &= \sigma^{-1}(L') \oplus F_k(\sigma^{-1}(L') \oplus R') \\ R &= R' \oplus F_k(\sigma^{-1}(L') \oplus R')\,. \end{align} We can see this works because \begin{align} \sigma^{-1}(L') &= L \oplus F_k(L \oplus R)\,, \end{align} and \begin{align} \sigma^{-1}(L') \oplus R' &= L \oplus F_k(L \oplus R) \oplus R \oplus F_k(L \oplus R) \\ &= L \oplus R\,. \end{align}
• Does $\sigma(\cdot)$ have to be applied to $L$? Can be applied to both $L$ and $R$? – Melab Oct 11 '17 at 0:49
• Only applied to $L$. – Samuel Neves Oct 11 '17 at 4:41
• But can it be applied to $R$, too? – Melab Oct 11 '17 at 11:19